platform_system_sepolicy/tools/version_policy.c

/*
 * version_policy.c - Takes the given public platform policy, a private policy
 * and a version number to produced a combined "versioned" policy file.
 */
#include <errno.h>
#include <getopt.h>
#include <stdbool.h>
#include <stdio.h>
#include <sys/stat.h>
#include <cil/android.h>
#include <cil/cil.h>
#include <cil/cil_write_ast.h>

void __attribute__ ((noreturn)) static usage(char *prog) {
	printf("Usage: %s [OPTION]...\n", prog);
	printf("\n");
	printf("Options:\n");
	printf("  -b, --base=<file>          (req'd) base policy for versioning.\n");
	printf("  -m, --mapping              generate cil version  mapping from base policy\n");
	printf("  -n, --number               (req'd) version number to use.\n");
	printf("  -o, --output=<file>        write cil policy to <file>\n");
	printf("  -t, --tgt_policy           policy to be versioned according to base policy\n");
	printf("  -h, --help                 display usage information\n");
	exit(1);
}

/*
 * read_cil_file - Initialize db and parse CIL input file.
 */
static int read_cil_file(struct cil_db **db, char *path) {
	int rc = SEPOL_ERR;
	FILE *file;
	struct stat filedata;
	uint32_t file_size;
	char *buff = NULL;

	cil_db_init(db);
	file = fopen(path, "re");
	if (!file) {
		fprintf(stderr, "Could not open file: %s\n", path);
		goto file_err;
	}
	rc = stat(path, &filedata);
	if (rc == -1) {
		fprintf(stderr, "Could not stat file: %s - %s\n", path, strerror(errno));
		goto err;
	}
	file_size = filedata.st_size;
	buff = malloc(file_size);
	if (buff == NULL) {
		fprintf(stderr, "OOM!\n");
		rc = SEPOL_ERR;
		goto err;
	}
	rc = fread(buff, file_size, 1, file);
	if (rc != 1) {
		fprintf(stderr, "Failure reading file: %s\n", path);
		rc = SEPOL_ERR;
		goto err;
	}
	fclose(file);
	file = NULL;

	/* creates parse_tree */
	rc = cil_add_file(*db, path, buff, file_size);
	if (rc != SEPOL_OK) {
		fprintf(stderr, "Failure adding %s to parse tree\n", path);
		goto err;
	}
	free(buff);

	return SEPOL_OK;
err:
	free(buff);
	fclose(file);
file_err:
	cil_db_destroy(db);
	return rc;
}

int main(int argc, char *argv[])
{
	int opt_char;
	int opt_index = 0;
	int rc = SEPOL_ERR;
	bool mapping = false;
	char *base = NULL;
	char *tgt_policy = NULL;
	char *num = NULL;
	char *dot;
	char *output = NULL;
	struct cil_db *base_db = NULL;
	struct cil_db *out_db = NULL;

	static struct option long_opts[] = {
		{"help", no_argument, 0, 'h'},
		{"base", required_argument, 0, 'b'},
		{"mapping", no_argument, 0, 'm'},
		{"number", required_argument, 0, 'n'},
		{"output", required_argument, 0, 'o'},
		{"tgt_policy", required_argument, 0, 't'},
		{0, 0, 0, 0}
	};

	while (1) {
		opt_char = getopt_long(argc, argv, "b:mn:o:t:h", long_opts, &opt_index);
		if (opt_char == -1) {
			break;
		}
		switch (opt_char) {
		case 'b':
			base = strdup(optarg);
			break;
		case 'm':
			mapping = true;
			break;
		case 'n':
			num = strdup(optarg);
			break;
		case 'o':
			output = strdup(optarg);
			break;
		case 't':
			tgt_policy = strdup(optarg);
			break;
		case 'h':
			usage(argv[0]);
		default:
			fprintf(stderr, "Unsupported option: %s\n", optarg);
			usage(argv[0]);
		}
	}
	if (optind < argc) {
		fprintf(stderr, "Unknown arguments supplied\n");
		usage(argv[0]);
	}
	if (num == NULL || base == NULL || (mapping == false && tgt_policy == NULL)) {
		fprintf(stderr, "Please specify required arguments\n");
		usage(argv[0]);
	}

	/* policy language doesn't like '.', so replace them with '_' in mapping version */
	dot = num;
	while ((dot = strchr(dot, '.')) != NULL) {
		*dot = '_';
		++dot;
	}

	if (mapping && tgt_policy) {
		fprintf(stderr, "Please select only one mode between --mapping and --tgt_policy\n");
		usage(argv[0]);
	}

	/* gimme only the important details */
	cil_set_log_level(CIL_WARN);

	/* read platform policy */
	rc = read_cil_file(&base_db, base);
	if (rc != SEPOL_OK) {
		goto exit;
	}

	if (mapping) {
		rc = cil_android_attrib_mapping(&out_db, base_db, num);
		if (rc != SEPOL_OK)
			goto exit;
	} else {
		/* read target policy, ready for manipulation */
		rc = read_cil_file(&out_db, tgt_policy);
		if (rc != SEPOL_OK) {
			goto exit;
		}
		/* attributize the target policy */
		rc = cil_android_attributize(out_db, base_db, num);
		if (rc != SEPOL_OK) {
			goto exit;
		}
	}
	rc = cil_write_ast(out_db, output);
	if (rc != SEPOL_OK) {
		goto exit;
	}

exit:
	free(base);
	free(tgt_policy);
	free(num);
	free(output);
	cil_db_destroy(&base_db);
	cil_db_destroy(&out_db);
	return rc;
}